NIS2 and cybersecurity for French SMEs in 2026

NIS2 expands the European cybersecurity framework. For SMEs and mid-caps, the issue is not only IT. A cyber incident can stop invoicing, payroll, payments, orders, customer data and business continuity. Even when a company is not directly in scope, customers, insurers, banks or large contractors may still require evidence.

This article connects with our resources on compliance audits, organisational audit, DPO requirements, French e-invoicing and SME financial dashboards.

ANSSI describes NIS2 as an unprecedented expansion of cybersecurity regulation. Since 17 March 2026, ANSSI has made the ReCyF, Référentiel Cyber France, available as a working document listing recommended measures to meet NIS2 security objectives. It is not mandatory by default at this stage, but it is useful for future in-scope entities.

Freshness note: updated on 3 May 2026. Scope should be confirmed against final French transposition and current ANSSI guidance.

NIS2 targets sectors considered critical or important for the economy and society. ANSSI distinguishes future essential and important entities. MonEspaceNIS2 guidance indicates, as a general rule and subject to exceptions, that essential entities are those in highly critical sectors and meeting size thresholds such as more than 250 employees or turnover above EUR 50m.

Management should work step by step:

1. Identify the exact sector.
2. Check entity and group size.
3. Look for special inclusion cases.
4. Review contractual cybersecurity duties.
5. Document the conclusion, even if the company is out of scope.

An SME may survive a few hours without a marketing website. It survives much less comfortably without payroll, banking, invoicing, ERP, point of sale, customer files or accounting evidence. Cybersecurity is therefore a finance issue.

Our chartered accountant view: useful cyber mapping starts with cash-generating and statutory processes. The real question is how long the business can operate without invoicing, paying and filing.

• map critical systems;
• list providers, admin rights and cloud contracts;
• enable MFA on banking, email, payroll, accounting and ERP;
• segregate rights by function;
• test backups, not only schedule them;
• document an incident procedure;
• include cyber risk in cash planning;
• review cyber-insurance clauses and exclusions.

SMEs can connect this work to digital finance transformation, outsourced CFO support and French accounting services. Tech companies should also review our startups and tech page. Power BI can track critical access, incidents and action plans.

Finance leaders should not wait for a formal in-scope notification before improving resilience. A pragmatic 90-day plan starts with payment security and business continuity. First, review all people who can create, approve or release payments. Second, verify that payroll, invoicing, accounting and banking tools have multi-factor authentication and that admin accounts are limited. Third, test whether accounting records and invoices can be restored from backups. Fourth, run a tabletop exercise: if the finance mailbox is compromised on a payroll week, who freezes payments, who contacts the bank, who informs employees and who communicates with clients?

The same work improves due diligence. Investors, lenders and large customers increasingly ask about cybersecurity maturity. A concise file with system mapping, access review, backup tests, incident procedure, insurance review and supplier list gives management a credible answer. It also helps the accountant understand where accounting evidence is stored and how quickly it can be recovered after an incident.

Many SMEs will feel NIS2 through contracts before they feel it through direct supervision. A software vendor, logistics provider, finance outsourcer or industrial subcontractor may be asked by a regulated customer to prove basic cyber hygiene. This is why the decision cannot be left only to IT. Sales, legal and finance need a shared response pack with certifications, policies, incident contacts and evidence of controls.

• Follow French transposition and ANSSI updates.
• Large customers may push NIS2-style requirements to suppliers.
• Untested backups are false comfort.
• CEO fraud and payment fraud remain major financial risks.
• Cyber incidents belong in cash and continuity scenarios.